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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
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- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1)IEI Responsive to communication(s) filed on 23 June 2003 . 
2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) E3 Claim(s) 1-75 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) S Claim(s) 7-75 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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. 1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 
Claim Rejections - 35 USC § 112 



1 . The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

2. Claims 1-75 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply with 
the enablement requirement. The claim(s) contains subject matter which was not described in 
the specification in such a way as to enable one skilled in the art to which it pertains, or with 
which it is most nearly connected, to make and/or use the invention. The claims language fails to 
interrelate essential elements of the invention as defined by the Applicant in the specification. 

3. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

4. Claims 1-75 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

5. Claims 1-12 and 70-73 are rejected under 35 U.S.C. 1 12, second paragraph, as being 
incomplete for omitting essential elements, such omission amounting to a gap between the 
elements. See MPEP § 2172.01. The omitted elements are: the claims language fails to specify 
how the features combined into useful pairs facilitate the detection of spam. 
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6. Claims 13-24 are rejected under 35 U.S.C. 112, second paragraph, as being incomplete 
for omitting essential structural cooperative relationships of elements, such omission amounting 
to a gap between the necessary structural connections. See MPEP § 2172.01. The omitted 
structural cooperative relationships are: the claim fails to point out and specify applicant's 
invention. 

7. Claims 25-32 are rejected under 35 U.S.C. 1 12, second paragraph, as being incomplete 
for omitting essential structural cooperative relationships of elements, such omission amounting 
to a gap between the necessary structural connections. See MPEP § 2172.01. The omitted 
structural cooperative relationships are: the claim does not point and specify applicant's 
invention. 

8. Claims 33-41 are rejected under 35 U.S.C. 1 12, second paragraph, as being incomplete 
for omitting essential structural cooperative relationships of elements, such omission amounting 
to a gap between the necessary structural connections. See MPEP § 2172.01. The omitted 
structural cooperative relationships are: claim language fails to specify how the component 
analyzes all features of a message header. 

9. Claims 42-52 are rejected under 35 U.S.C. 112, second paragraph, as being incomplete 
for omitting essential steps, such omission amounting to a gap between the steps. See MPEP 

§ 2172.01. The omitted steps are: the claims language fails to specify how the features combined 
into useful pairs to facilitate the detection of spam. 

10. Claims 53-65 and 74-75 are rejected under 35 U.S.C. 112, second paragraph, as being 
incomplete for omitting essential steps, such omission amounting to a gap between the steps. 
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See MPEP § 2172.01. The omitted steps are: the claim language fails to point out and specify 
applicant' invention. 

1 1 . Claims 66-69 are rejected under 35 U.S.C. 112, second paragraph, as being incomplete 
for omitting essential steps, such omission amounting to a gap between the steps. See MPEP 
§ 21 72.01 . The omitted steps are: claim language fails to specify how the analysist of all 
features of a message headers is done. 



Claim Rejections - 35 USC §102 

12. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

13. Claims 1-12, 42-52, 66-68, 70-75 are rejected under 35 U.S.C. 102(e) as being 
anticipated by U.S. Patent Application No. 2003/0041 126 to Buford et al. 



a. As per claim 1, Buford et al teaches a spam detection system comprising: a component 
that identifies features relating to at least a portion of origination information of a message: and a 
component that combines the features into useful pairs for use in connection with training a 
machine learning filter to facilitate detecting spam (See page 4, paragraph [0040-0041]). 
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b. As per claim 2, Buford et al wherein each pair comprises at least one of the following: at 
least one of a domain name and a host name in a MAIL FROM command; at least one of a 
domain name and a host name in a HELO COMMAND; at least one of an IP address and a 
subnet in a Received from header: at least one of a domain name and a host name in a Display 
name: at least one of a domain name and a host name in a Message From line, and at least one 
time zone in a last Received from header (See page 3 and page 4). 

c. As per claim 3, Buford et al teaches wherein the domain name is derived from the host 
name (See page 3). 

d. As per claim 4, Buford et al teaches wherein the subnet comprises one or more IP 
addresses that share a first number of bits in common (See page 4). 

e. As per claim 5, Buford et al teaches wherein a useful pair is any one of a domain name 
and a host name from a Message From and from a HELO command (See page 3). 

f. As per claim 6, Buford et al teaches wherein a useful pair is a Display name domain 
name and host name and a Message From domain name and host name (See page 3 and page 4)\ 

g. As per claim 7, Buford et al teaches wherein a useful pair is any one of a domain name 
arid a hust name in a Message From and any one of a Recei ved from IP address and subnet (Sec 
page 3 and page 4). 
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h. As per claim 8, Buford et al teaches wherein a useful pair is a senders alleged time zone 
and a Message From domain name (See page 3 and 4). 

i. As per claim 9. Buford et al teaches wherein a useful pair comprises a sender's type of 
mailing software and any one of a domain name, host name and user name derived from one of 
an SMTP command and a message header (See page 3 and 4). 

j. As per claim 10, Buford et al teaches wherein origination information comprises SMTP 
commands, the SMTP commands comprise a HELO command, a MAIL FROM command, and a 
DATA command (See pages 3 and 4). 

k. As per claim 1 1, Buford et al teaches wherein the DATA command comprises a Message 
From line, senders alleged time zone, and sender's mailing software (See paged 3 and 4). 

1. As per claim 12, Buford et al teaches further comprising a component that applies one or 
more heuristics consistently to mail messages to obtain consistent feature pairing (See page 3 and 
page 4). 

m. As per claim 33, Buford teaches a spam detection system comprising: a component that 
analyzes substantially all features of a message header in connection with training a machine 
learning spam filter (See page 3 and 4). 
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n. As per claim 34, Buford et al teaches wherein the features of the message header 
comprise at least one of a presence and absence of at least one message header type, the message 
header types comprising X-Priority, mail software, and headers line for unsubscribing (See page 
3 and 4). 

o. As per claim 35, Buford et al teaches wherein the features of the message header further 
comprise content associated with at least one message header type (See page 3 and 4). 

p. As per claim 36, Buford et al teaches further comprising: a component that analyzes at 
least a portion of a message for images and related image information; and a component that 
generates features relating to any one of the images and related image information (See page 3 
and 4). 

q. As per claim 37, Buford et al teaches wherein the image information comprises image 
size, image quantity, location of image, image dimensions, and image type (See page 2). 

r. As per claim 38, Buford et al teaches wherein the image information comprises the 
presence of a first URL and a second URL such that the image is inside of a hyperlink (See page 
3 and 4). 

s. As per claim 39, Buford et al teaches wherein the message comprises a tag pattern having 
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the form of <A HREF="the first URL"><IMG SRC= M the second URL"></A (See 2). 

t. As per claim 40, Buford et al teaches wherein the features are used in connection with 
training a machine learning filter (See page 2). 

u. As per claim 41 , Buford et al teaches comprising a component that analyzes a message 
for HTML attributes and location of HTML attributes as they appear in a tag pattern (See page 
2). 

v. As per claim 42 -52, 68, 70-72, see claims 1-12 above, 
w. As per claim 66-67, see claims 33-41 above. 

14. Claims 13-28, 30-33, 53-65 and 69 are rejected under 35 U.S.C. 102(e) as being 
anticipated by U.S. Patent No. 6,768991 to Hearnden. 

a. As per claim 13, Hearnden teaches a spam detection system comprising: a component 
that analyzes a portion of a message via searching for particular character sequences that are 
indicative of spam, wherein the particular sequences are not restricted to whole words; and a 
component that generates features relating to the character sequences of any length (See col. 3- 
5} 



Application/Control Number: 1 0/60 1 ,74 1 Page 9 

Art Unit: 2141 

b. As per claims 14, Hearnden teaches wherein the component generates features for each 
run of characters up to a maximum character run length (See col. 3-6). 

c. As per claim 15, Hearnden teaches wherein the component generates features for 
substantially all character sequences up to some length n (See page 3 and 4). 

d. As per claim 16, Hearnden teaches wherein the character sequences comprise at least one 
of letters numbers, punctuation symbols and characters of foreign languages (See col. 6). 

e. As per claim 17, Hearnden teaches wherein the particular character sequences comprise 
at least one of random letters, symbols, and punctuation as chaff at any one of a beginning and 
end of at least one of a subject line of a message and a message body (See col. 3 -5) 

f As per claim 1 8, Hearnden teaches wherein random character sequences comprise 
character n-grams which are indicative of spam-like messages (See page 4). 

g. As per claim 19, Hearnden teaches wherein the character n-grams are located in at least 
one of From address, subject line, text body, html body, and attachments (See col. 3-5). 



h. As per claim 20, Hearnden teaches wherein the character n-grams are position dependent 
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i. As per claim 21, Hearnden teaches for use with the messages comprising at least one of 
foreign language text, Unicode character types, and other character types not common to English 
(See col. 5-6). 

j. As per claim 22, Hearnden teaches wherein the foreign language text comprises 
substantially non-space separated words (See col. 3-5). 

k. As per claim 23, Hearnden teaches wherein n-grams are used only for characters not 
typically separated by spaces (See col. 3-5). 

1. As per claim 24, Hearnden teaches further comprising a component that extracts 
character sequences obfuscated by punctuation using a pattern-match technique (See col. 3-5). 

m. As per claim 25, Hearnden teaches a spam detection system comprising: a component 
that analyzes a portion of a message via searching for instances of a string of random characters 
that are indicative of the message being spam (See col. 3-5). 

n. As per claim 26, Hearnden teaches a component that generates features corresponding to 
the instances of random character strings to facilitate determining an entropy measurement for 
each string (See col. 3-5). 



o. As per claim 27, Hearnden teaches wherein the system measures a value correlated with 



Application/Control Number: 10/601,741 
Art Unit: 2141 



Page 1 1 



entropy (See col. 3-5). 

p. As per claim 28, Hearnden teaches wherein a high value correlated with entropy is 
indicative of spam (See col. 3-5). 

q. As per claim 30, Hearnden teaches wherein the average entropy of a character string is 
used (See col. 3-5). 

r. As per claim 3 1 , Hearnden teaches wherein the string of random characters is chaff (See 
col. 3-5). 

s. As per claim 32, Hearnden teaches wherein the relative entropy compares the entropy 
measurement at any one of a beginning and end of at least one of a subject line and message 
body with the entropy measurement at a middle of at least one of the subject line and message 
body (See col 3-5). 



t. As per claims 53-65, 69, see claims 13-24 above. 
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Conclusion 



1 5. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Djenane M. Bayard whose telephone number is (571) 272-3878. 
The examiner can normally be reached on Monday- Friday 5:30 AM- 3:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia can be reached on (571) 272-3880. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Djenane Bayard 
Patent Examiner 
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